蜜罐博弈中信念驱动的攻防策略优化机制

Belief Driven Attack and Defense Policy Optimization Mechanism in Honeypot Game

作为一种典型的欺骗防御手段,蜜罐技术在主动诱捕攻击者方面具有重要意义。然而现有设计方法主要通过博弈模型来优化蜜罐的诱捕决策,忽略了攻击者的信念对双方博弈决策的影响,存在自适应优化决策能力弱、易被攻击者识破并利用等不足。为此,提出了基于信念的蜜罐博弈机制(Belief Based Honeypot Game Mechanism, BHGM)。BHGM基于攻击者完成任务的多轮博弈过程,重点关注蜜罐采取动作对攻击者信念的影响以及信念对攻击者是否继续攻击的影响。同时,基于树上限置信区间(Upper Confidence Bound Apply to Tree, UCT)设计了信念驱动的攻防最优策略求解算法。仿真实验结果表明,信念驱动的攻击方策略能基于当前信念选择继续攻击或及时止损以获得最大收益,而信念驱动的蜜罐策略在考虑风险的情况下能尽量降低攻击方怀疑,以诱骗其继续攻击,从而获得更大收益。

As a typical deception defense means, honeypot technology is of great significance in actively trapping attackers.The existing design methods mainly optimize the trapping decision of honeypot through the game model, ignoring the impact of the attacker’s belief on the game decision of both sides.There are some shortcomings, such as weak adaptive optimization decision-making ability, easy to be seen through and used by the attacker and so on.Therefore, a belief based honeypot game mechanism(BHGM) is proposed.Based on the multi round game process of attacker completing the task, BHGM focuses on the impact of honeypot action on attacker’s belief and the impact of belief on whether the attacker continues to attack.At the same time, a belief driven algorithm for solving the optimal attack and defense strategy is designed based on the upper confidence bound apply to tree(UCT).Simulation results show that the belief driven attacker strategy can choose to continue the attack or stop the loss in time based on the current belief to obtain the maximum profit, while the belief driven honeypot strategy can reduce attacker’s suspicion as much as possible to lure him to continue the attack and obtain greater profit.